On characterisation and decomposition of internet traffic dynamics

Marnerides, Angelos and Hutchison, David and Mauthe, Andreas (2011) On characterisation and decomposition of internet traffic dynamics. PhD thesis, Lancaster University.

Abstract

The comprehension of backbone and edge network traffic dynamics provides the foundational element for crucial traffic engineering tasks employed by Internet Service Providers (ISPs) . These tasks include anomaly diagnosis, network capacity planning, traffic classification and Quality of Service (QoS) provisioning. Due to the rapid development of emerging Internet technologies, the expansion of networked devices and evolving user behaviour, the task of statistically interpreting traffic characteristics poses great challenges. There have been numerous propositions having network traffic scenarios mapped as statistical, information-theoretic and signal processing case studies. Nevertheless, by virtue of the different volume traffic characteristics exposed by each network independently and the different intra and inter-networking interactions conducted in each case, the idea of manifesting a generic modelling solution is a very difficult task. In parallel, the macroscopic, composite volume analysis performed by various methods in most cases invokes low visibility with respect to protocol-specific behaviour. This thesis critically re-assesses well known traffic profiling modelling schemes as used in the past and introduces new approaches for capturing the fundamental properties of traffic characterisation. Through network volume aggregate analysis, as well as via the employment of a traffic decomposition -approach where transport layer protocols are independently modelled, highly fluctuating and dynamic characteristics appear in backbone and edge network links. These characteristics are statistically interpreted and justified with one of the main contributions of this work, namely the employment of Time-Frequency (TF) representations and higher order spectra for validating de facto statistical assumptions on a microscopic, protocol-specific approach. Validation of Gaussianity, linearity and stationarity constitutes a core pre-requisite within the modelling process on JP networks which has not been thoroughly investigated by the majority of studies in current and past literature. The thesis explicitly addresses this issue and indicates its importance. Furthermore, through the direct exploitation of higher order spectral capabilities and particularly the bispectrum, traffic engineering tasks may be beneficially improved. In spite of the advantageous diagnostics offered in several traffic engineering applications such as anomaly diagnosis, the practical capabilities offered by the bispectrum are exhibited within a particular traffic peak analysis scenario which provides a basic element within the traffic engineering process of network capacity planning. I The validation of the stationarity hypothesis has identified the existence of highly non-stationary traffic characteristics on a volume aggregate and protocol-oriented basis. By virtue of this outcome, this work contributes to the applicability of energy TF distributions for the explicit traffic characterisation task of application-based traffic classification. The suitability of energy TF distributions for profiling non-stationary signals allows the employment of a novel signaloriented classification scheme. In particular, the thesis illustrates the classification of application layer protocols based on the volume utilization initiated on the transport layer by TCP and UDP.